CVE-2026-100352
7.5HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-754
Impact
Remote, unauthenticated attackers can crash your service or trigger per-request panics via network requests. They only need to send a crafted YAML request body containing NaN or infinity values to an endpoint validating numeric constraints.
Root cause
The OpenAPI 3.1 validation logic passes YAML NaN and infinity values directly to the jsonschema dependency without finite-number checks, causing a nil pointer dereference on big.Rat.
Affected systems
kin-openapi prior to 0.148.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade kin-openapi to version 0.148.0 or later. If you cannot patch immediately, block or reject incoming request bodies with Content-Type application/yaml and application/x-yaml at your reverse proxy or API gateway.
$ go get github.com/getkin/kin-openapi@v0.148.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.